Published: October 17, 2026
Author: DigitalSpying Threat Intelligence Desk
Category: Cloud Security & SaaS Supply Chain
Tags: ConnectWise, SkyKick, Microsoft 365, OAuth Tokens, App Registration, Supply Chain Attack, Huntress, Cloud Identity
Executive Summary
In a severe demonstration of downstream SaaS supply chain risk, managed service provider (MSP) software leader ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) following confirmation that threat actors compromised a high-privilege multi-tenant application credential.
As revealed in forensic telemetry published by Huntress and confirmed by The Hacker News and BleepingComputer, adversaries weaponized the stolen Microsoft 365 API secret to authenticate directly into at least 173 customer Microsoft 365 environments. Because enterprise backup platforms require expansive delegated Microsoft Graph API permissions to perform mailbox, SharePoint, and Teams archiving, the compromised application secret granted attackers silent administrative access to corporate email stores, tenant user directories, and cloud configuration settings without requiring user credentials or triggering standard Multi-Factor Authentication (MFA) prompts.
Technical Deep-Dive: Anatomy of the SkyKick API Secret Compromise
1. Multi-Tenant Application Architecture in Microsoft Entra ID
Enterprise backup services such as ConnectWise Cloud Backup rely on Microsoft Entra ID (formerly Azure AD) multi-tenant application registrations:
* Service Principal Consent: When an MSP or enterprise subscribes to the backup platform, an administrator performs an admin consent flow, granting the SkyKick multi-tenant enterprise application high-privilege delegated and application permissions across the customer tenant.
* Excessive Graph API Scopes: To archive an entire organization's data footprint, the application principal is typically granted broad API roles, including Mail.ReadWrite, Directory.Read.All, Files.ReadWrite.All, and User.ReadWrite.All.
* The Centralized Key Risk: Authentication relies on an application client ID and a shared cryptographic client secret (API password) or X.509 certificate managed centrally within the vendor’s cloud infrastructure.
2. The Intrusion Vector & Non-Interactive Token Generation
Forensic investigations by Huntress revealed that adversaries obtained an unencrypted or leaked API secret associated with the SkyKick service application:
1. Direct OAuth2 Client Credentials Flow: The attackers did not compromise individual customer passwords or bypass MFA. Instead, they issued automated HTTP POST requests directly to Microsoft's OAuth2 token endpoint (https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token) utilizing the client_credentials grant type, passing the stolen application secret and the victim organization’s tenant ID.
2. Issuance of App-Only Access Tokens: Entra ID validated the genuine application secret and returned JSON Web Tokens (JWT) possessing full application-level permissions across the victim tenant.
3. Automated Graph Reconnaissance: Using the acquired bearer tokens, the attackers scripted queries against Microsoft Graph endpoints (https://graph.microsoft.com/v1.0/):
* Enumerating global administrator accounts and tenant security configurations.
* Searching executive mailboxes for sensitive financial keywords, wire instructions, and confidential M&A communications.
* Injecting secondary OAuth application registrations or service principals to establish long-term backdoor persistence in case the primary vendor secret was revoked.
3. ConnectWise Response & Remediation Measures
Upon confirmation of widespread unauthorized access, ConnectWise severed external network connections to the Cloud Backup infrastructure, suspended customer portal access, and collaborated with Microsoft Threat Intelligence to forcefully revoke the compromised application secrets globally across all customer Entra ID tenants.
Strategic Impact on the MSP & SaaS Ecosystem
The ConnectWise SkyKick incident exposes structural security flaws inherent in multi-tenant SaaS integration models:
* The Single Point of Failure (SPOF): A single compromised secret inside a trusted SaaS vendor creates an instantaneous backdoor into thousands of downstream customer environments, bypassing every perimeter control and endpoint defense deployed by the customer.
* The Blindspot of Service Principal Monitoring: Traditional Security Operations Centers (SOCs) focus intensely on interactive user logins and anomalous IP geolocation for human employees. Non-interactive service principal authentications using legitimate enterprise application IDs frequently generate no security alerts, allowing malicious API queries to blend into normal backup synchronization traffic.
Tactical Mitigations & Enterprise Tenant Hardening Playbook
Microsoft 365 administrators and MSP security engineers should immediately execute the following defensive protocols:
1. Verify and Quarantine Enterprise Applications:
* In the Microsoft Entra admin center, navigate to Identity > Applications > Enterprise applications. Review all applications associated with ConnectWise, SkyKick, or third-party backup tools.
* If Cloud Backup is no longer actively managed, forcefully revoke consent and delete the enterprise application registration.
2. Audit Entra ID Audit & Sign-In Logs for Non-Interactive Abuse:
* Query Non-interactive user sign-ins and Service principal sign-ins for the SkyKick application ID (appId) over the past 60 days. Filter for anomalous source IP addresses (e.g., commercial VPNs, Tor exit nodes, or foreign cloud providers like DigitalOcean or Linode).
* Review Audit logs for recent Add service principal, Consent to application, or Add application credential activities initiated by service accounts.
3. Transition from Shared Secrets to Managed Identities & OIDC:
* Organizations building custom integrations must eliminate long-lived static client secrets in favor of Workload Identity Federation using OpenID Connect (OIDC) or Azure Managed Identities.
* Enforce certificate-based authentication with Hardware Security Module (HSM) backing rather than plaintext string secrets for high-privilege application registrations.
4. Implement Conditional Access for Workload Identities:
* Deploy Microsoft Entra Conditional Access for Workload Identities to restrict application token issuance strictly to verified, trusted corporate egress IP addresses, neutralizing stolen secrets used from external attacker infrastructure.
Sources & Threat Intelligence References:
* Huntress Threat Research: ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
* The Hacker News: Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
* BleepingComputer: Hackers Breach Microsoft 365 Tenants via ConnectWise Supply-Chain Attack